Ubuntu fixes Fetchmail denial-of-service flaws in USN-9013-1
Original title: USN-9013-1: Fetchmail vulnerabilities
Two named issues can crash Fetchmail on Ubuntu 16.04, 18.04 and 20.04 LTS; the notice snippet cuts off a third finding.
Ubuntu security notice USN-9013-1 covers Fetchmail flaws that can crash the client and cause a denial of service. Christian Herdtweck found mishandling of certain long log messages (CVE-2021-36386). A separate SMTP status-code issue (CVE-2025-61962) could be triggered by an attacker controlling a malicious server. Both issues affected only Ubuntu 16.04 LTS, 18.04 LTS and 20.04 LTS. The feed text cuts off before describing Tristan Madani’s finding.
Unconfirmed: The snippet ends before describing Tristan Madani’s issue, so its impact and scope are unknown.
- CVE-2021-36386 involves certain long log messages.
- CVE-2025-61962 involves certain SMTP status code messages.
- The notice does not state exploitation or fixed package versions in this snippet.
Impact: Fetchmail crash and denial of service
| Product | Affected |
|---|---|
| Ubuntu Fetchmail | Ubuntu 16.04 LTS, 18.04 LTS, and 20.04 LTS for the two named issues |
- 1.Install the Fetchmail updates from USN-9013-1 on affected Ubuntu releases.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-36386 | report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, which might allow mail servers to cause… | 7.5 | 3% | ||
| CVE-2025-61962 | In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context | 5.9 | <1% |
From the original article
Christian Herdtweck discovered that Fetchmail incorrectly handled certain long log messages. A remote attacker could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service. This issue only affected Ubuntu 16.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.